CVE-2026-40506 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
Unauthenticated attackers can trigger arbitrary recursive directory deletion in OpenEMR by exploiting a path traversal flaw in standard_tables_manage.php via a crafted URL.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40506?
CVE-2026-40506 is a high-severity path traversal vulnerability in openemr, published on 17 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.
Weakness: CWE-22
Which versions are affected by CVE-2026-40506?
How do I fix CVE-2026-40506?
No fix has been published for CVE-2026-40506 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40506 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40506 exists.
Sources
Also known as GHSA-hj9x-33vw-5g3x.